Module constraint checks fail incorrectly due to str_replace

Created on 9 October 2019, almost 5 years ago
Updated 31 March 2023, over 1 year ago

When viewing the module list at /admin/modules the checkboxes are disabled if any of the dependencies of that module are not present. At core 8.7 this worked fine. But at 8.8 if a module depends on a core module with a given version, the check always fails. The problem is due to interaction with the contrib module git_deploy β†’ , however it is core code which actually causes the problem.

An example is Views Bulk Operations, which depends on Views >=8.4 (ie core 8.4 and up). This test passed OK at Core 8.7 but at Core 8.8 the test fails and VBO cannot be installed. This is due to a quirk in the programming in core/modules/system/src/Form/ModulesListForm.php, where the string \Drupal::CORE_COMPATIBILITY . '-' i.e. '8.x-' in this case, is removed from the module version. The intention is to convert contrib module versions, say '8.x-1.2' into '1.2' for comparison. When the module is a core module the version at core 8.7 was 8.7.x-dev and this gets passed through and all works fine.

But at Core 8.8 we have the unintended side-effect that removing '8.x-' also matches the of the core version '8.8.x-dev' which is not the intented change. The value passed on is therefore '8.dev' which fails to satisfy the constraint test >=8.4. Without git_deploy the version of the core module is 8.8.n-dev (taken from \Drupal::VERSION) where n is a number, say 8.8.3-dev, and this works fine. But git_deploy changes the patch digit to x, so that the version is 8.8.x-dev and this is where the str_replace incorrectly removes the middle '8.x-'

To see this bug in action, create a drupal 8.8 dev site, install the git_deploy contrib module, then try ti download Views Bulk Operations and try to enable it.

Update for D9 and D10

The problem is not immediately apparent at the current dev core versions 9.5.x and 10.1.x because it only occurs when the minor version is 8. It was a problem at core 8.8.x and will be a problem again when Drupal 9 reaches 9.8, and likewise with 10.8.

The code in question has now moved to core/lib/Drupal/Core/Extension/ModuleDependencyMessageTrait.php but it still contains the same problem.

Proposed Solution

Change the plain str_replace() to a preg_replace() to enforce that the string replacement is only matched at the start of the core version, not anywhere within it.

πŸ› Bug report
Status

Fixed

Version

9.5

Component
InstallΒ  β†’

Last updated 2 days ago

No maintainer
Created by

πŸ‡¬πŸ‡§United Kingdom jonathan1055

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • The Needs Review Queue Bot β†’ tested this issue. It either no longer applies to Drupal core, or fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

    Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.

    Consult the Drupal Contributor Guide β†’ to find step-by-step guides for working with issues.

  • Status changed to Postponed: needs info over 1 year ago
  • πŸ‡³πŸ‡ΏNew Zealand DanielVeza Brisbane, AU

    The code in question in ModuleDependencyMessageTrait has changed in the last three years since this issue was raised. Is this still an issue? Can we get some steps to reproduce?

  • πŸ‡¬πŸ‡§United Kingdom jonathan1055

    I've updated the IS. It still is a problem, but will not be apparent until we get to core version 9.8.x. I will upload a new patch as the problem code has been moved again.

    Using git_deploy I can simulate the core version being moved on to 9.8 and can then reproduce the problem. I was also looking a adding a test to the 'system' module to demonstrate what happens when the core version is 9.8.x or 10.8.x instead of 9.8.0, 10.8.0 etc.

  • Status changed to Needs review over 1 year ago
  • πŸ‡¬πŸ‡§United Kingdom jonathan1055

    New patch for 10.1, which also applies at 9.5

  • Status changed to Needs work over 1 year ago
  • πŸ‡ΊπŸ‡ΈUnited States smustgrave

    Hello @jonathan1055 reading the issue summary thanks for the update!

    Adding some tasks for "Remaining tasks" section.

    This will need a test case to show the problem.

    Thanks!

  • Status changed to Needs review over 1 year ago
  • πŸ‡¬πŸ‡§United Kingdom jonathan1055

    Thanks @smustgrave
    I have created a new test module to simulate the version change required, and added test coverage. The test module can be moved or renamed it required. The initial push to 10.1 mr is only for the test, so it should fail.

    Also for speed and reduced resource usage I have temporarily limited the tests to just one class.

  • @jonathan1055 opened merge request.
  • Status changed to Needs work over 1 year ago
  • πŸ‡ΊπŸ‡ΈUnited States smustgrave

    Test looks good!

    Can you revert the one test change and think I can mark it RTBC.

  • πŸ‡¬πŸ‡§United Kingdom jonathan1055

    Thanks @smustgrave, will do.

    For manual checking, the problem can be seen via UI. Install the new module (which will require local settings $settings['extension_discovery_scan_tests'] = TRUE;

    Then try to install the which now requires View >=9.2 but it is greyed out and fails the dependency check

    On question I had was is it OK to hardcode 9.2 and 9.8.x in the test modules? I used 9.x as an example because I am hoping this fix can be back-ported to Drupal 9. We will be hit by the bug in core 9.8.x sooner than we reach 10.8.x.

  • Status changed to Needs review over 1 year ago
  • πŸ‡¬πŸ‡§United Kingdom jonathan1055

    Branch has a random failure so I've clicked 'do not wait for branch to pass' :-)

  • πŸ‡¬πŸ‡§United Kingdom jonathan1055

    To answer my own question from #19 about hardcoding 9.2 and 9.8.x in the tests, there are existing tests in Drupal 10 that reference core 8.x etc, and use fixtures set up for Drupal 8, so I think this is fine to have 9.2 and 9.8.x in the new test.

  • Status changed to RTBC over 1 year ago
  • πŸ‡ΊπŸ‡ΈUnited States smustgrave

    Thanks for all the work on this @jonathan1055

  • πŸ‡¦πŸ‡ΊAustralia larowlan πŸ‡¦πŸ‡ΊπŸ.au GMT+10

    Crediting smustgrave for an issue summary update

    • larowlan β†’ committed cc05ac89 on 10.0.x
      Issue #3086845 by jonathan1055, smustgrave: Module constraint checks...
    • larowlan β†’ committed 1b4abdb0 on 10.1.x
      Issue #3086845 by jonathan1055, smustgrave: Module constraint checks...
    • larowlan β†’ committed d9ef1091 on 9.5.x
      Issue #3086845 by jonathan1055, smustgrave: Module constraint checks...
  • Status changed to Fixed over 1 year ago
  • πŸ‡¦πŸ‡ΊAustralia larowlan πŸ‡¦πŸ‡ΊπŸ.au GMT+10

    Committed to 10.1.x and backported to 10.0.x and 9.5.x - thanks!

  • πŸ‡¬πŸ‡§United Kingdom jonathan1055

    Thanks @larowlan for the commit and for backporting to 9.5.x
    The users of git_deploy β†’ (me included) will be grateful for this when we reach 9.8.x

  • Automatically closed - issue fixed for 2 weeks with no activity.

Production build 0.71.5 2024